Mapping the Location of 2.4 GHz Transmitters toAchieve Optimal Usage of an IEEE 802.11 Network

Daniel Wells1, Ingrid Siebörger2 and Barry Irwin3

Security and Networks Research GroupDepartment of Computer Science

Rhodes UniversityE-Mail: 1g03w0418@campus.ru.ac.za 2i.sieborger@ru.ac.za 3b.irwin@ru.ac.za

Abstract—This paper describes the use of a low cost 2.4 GHzspectrum analyser, the MetaGeek WiSpy device, in conjunctionwith custom developed client-server software for the accurateidentification of 2.4 GHz transmitters within a given area. TheWiSpy dongle together with the custom developed software allowfor determination of the positions of Wi-Fi transmitters to withina few meters, which can be helpful in reducing the work loadfor physical searches in the process of surveying the Wi-Finetwork and geographical area. This paper describes the tool andmethodology for a site survey as a component that can be usedin organisations wishing to audit their environments for Wi-Finetworks.

The tool produced from this project, the WiSpy Signal SourceMapping Tool, is a three part application based on a client-server architecture. One part interfaces with a low cost 2.4 GHzspectrum analyser, another stores the data collected from all thespectrum analysers and the third part interprets the data toprovide a graphical overview of the Wi-Fi network being analysed.The location of the spectrum analysers are entered as GPS points,and the tool can interface with a GPS device to automaticallyupdate its geographical location.

The graphical representation of the 2.4 GHz spectrum pop-ulated with Wi-Fi devices (Wi-Fi network) provided a fairlyaccurate method in locating and tracking 2.4 GHz devices.Accuracy of the WiSpy Signal Source Mapping Tool is hinderedby obstructions, interferences within the area or non line of sight.

Index Terms—Wi-Fi, Spectrum Analysis, Site Survey, Wi-Finetwork planning

I. INTRODUCTION

W IRELESS networking has brought computer networksinto a new, exciting and highly mobile environment.

Factors that need to be considered and understood duringimplementation of Wi-Fi networks include interference sourcesand security protocols. Setting up a Wireless Local Area Net-work (WLAN) is relatively simple, allowing users to achievemobility, and allow for easy, convenient access to the network.

IEEE 802.11b/g/n Wi-Fi specifications use the 2.4 GHzfrequency band [1], [2]. As these technologies become increas-ingly popular for the home and business, the 2.4 GHz spectrumis becoming cluttered, therefore a need for optimal use of themedium is required. Better utilisation of the 2.4 GHz radiofrequency (RF) can be achieved by assessing the current Wi-Fi spectrum usage before a network administrator installs a

The authors would like to acknowledge the financial support of Telkom SA,Business Connexion, Comverse SA, Stortech, Tellabs, Amatole, Mars Tech-nologies, openVOICE and THRIP through the Telkom Centre of Excellencein the Department of Computer Science at Rhodes University.

Wi-Fi access point (AP). By considering the site location for aWi-Fi network before installing hardware, the wireless networkcan be used to its full potential by minimising interference andoperating over the best possible channel.

By combining the frequency VS signal amplitude data fromthree (or more) 2.4 GHz spectrum analysers it is possible tolocate 2.4 GHz interference sources and transmitting Wi-Fidevices. The data from the spectrum analysers is combined toproduce a graphical display of a Wi-Fi network and devicesare located using the method of trilateration.

The graphical display enables users of the tool to discoverthe approximate locations of 2.4 GHz transmitters and inter-ference sources. The tool allows users to gain optimal use ofthe frequency by locating interference sources. Such a tool canpotentially prove invaluable for the auditing and planning ofwireless networks within an organisation.

This paper presents the MetaGeek WiSpy Spectrum Anal-yser [3] together with the client-server application that wasdeveloped. The paper is divided into two logical parts begin-ning with sections 2 and 3 which discuss related work andintroduce the WiSpy Signal Source Mapping Tool. The secondpart, sections 4 and 5, describe testing and results and discussrelevant conclusions.

II. RELATED WORK

The IEEE 802.11 (Wi-Fi) family of technologies have beenadopted on a global scale, and installed in equipment rangingfrom desktops and laptops to mobile phones, security camerasand home entertainment systems [4]. This paper focuses on802.11 b/g/n technologies because they tend to be near ubiq-uitous in the market place. 802.11a networks, which operateon a higher frequency of 5 GHz [5], are not commonly used,even though they operate on a less used band. 802.11a Wi-Fiis not discussed, as it is not as widely used on our campus, orin our testing.

Wi-Fi (specifically IEEE 802.11b/g/n) propagates over acluttered frequency of 2.4 GHz [1], [2]. Typically interfer-ence can be separated into two broad categories; traffic fromadjacent Wi-Fi networks and that arising from any othertransmitters operating in the same frequency [6]. Adjacent Wi-Fi networks are of the most concern to those living or workingin densely populated areas, or multi-tenant office buildingswhere Wi-Fi networks tend to be prevalent.

Some typical (non Wi-Fi) devices which cause interferenceare a range of cordless phones, any Bluetooth device, cordlessheadsets, wireless bridges, cordless video-game controllers andmicrowave ovens [7]. A microwave oven can create interfer-ence from up to 50 feet (15 meters) away and incur relativelyhigh packet retransmission [8]. Any source that has the samepropagation medium as the Wi-Fi network will corrupt thesignal reception [9]. Obstructions between antennas also leadsto reduced throughput because the radio link depends on theenergy diffracted around the object rather that direct radiation[10].

A tool to speed up the process of analysing interference andevaluating frequency usage is a spectrum analyser. Althoughmost spectrum analysers on the market are expensive andbulky, this project utilised a low-cost device with the formfactor of a typical USB flash drive. The MetaGeek WiSpy2.4 GHz Spectrum Analyser takes measurements of signalstrength (amplitude in dBm) across radio frequency (2400 -2483 MHz), and cost $199 USD each [11]. The WiSpy devicehas a receive sensitivity of -90 dBm, can make approximatelyfive full sweeps (collect frequency VS signal amplitude) persecond and operates as a low-speed USB Human InteractionDevice (HID) [12]. Due to the nature of HID devices, multipleoperating systems can use the device with standard drivers.This is the device on which this project was based, althoughwith minor modifications any spectrum analyser operating inthe 2.4 - 2.5 GHz range should work.

The WiSpy device can be used by a network plan-ner/administrator to assist in a site survey to determine thenumber and location of APs that provide optimum signalstrength for the organisation. A survey should ideally becompleted prior to installation, allowing the most effectiveplacement of APs and a sufficient amount of signal overlapbetween APs. The site survey should discuss the best Wi-Fichannel to be utilised and provide locations of any sourcesof interference that could negatively impact Wi-Fi networkperformance [8]. Issues with radio signals are that they donot propagate in equal distances in all directions as obstaclessuch as walls, filling cabinets and other interferences discussedpreviously cause more or less signal attenuation. A surveyshould offer information regarding the choice of antennas,whether they be directional or not and correctly placed toensure boundaries inside and outside the building, and that nocrucial areas exist without coverage [13]. A spectrum analysermakes the task of conducting a site survey much easier.

Specific concepts and terminology are important in help-ing understand how one is able to pinpoint the location of2.4 GHz signal sources. Signal strength in a Wi-Fi network ismeasured using dBm (decibel milliwatts), which is measuredon a logarithmic scale. An important fact about this scale is ifyou add 3 dBm, you double the power output and subtracting3 dBm will halve it [13]. Wi-Fi devices will be marked with areceive sensitivity and a transmitter power output in this scale.This measurement is particularly useful when working out thedistance a signal has travelled, if known at what strength thesignal was transmitted.

Another important concept is the method of trilateration,

Figure 1. Design of WiSpy SSM Tool

similar to triangulation in that it uses the location of knownpoints to discover the position of another point in space [14].Trilateration uses known distances, not angles, from threepoints to an unknown point to discover the exact location ofthe unknown point. Trilateration can be imagined as circlesoriginating from each known point where the radius of thecircle is the distance to the unknown point. Where the circlesintersect provides the location of the unknown point [14].

Using the WiSpy spectrum analyser together with the customclient-server software tool and the method of trilateration, Wi-Fi transmitters and interference sources can be tracked andfound. The following section describes the custom developedtool and its features.

III. WISPY SSM TOOL

The system created was named the WiSpy SSM Tool, SSMfor Signal Source Mapping. The system was developed in twoparts (applications) with a webservice to connect them andstore the signal data, Figure 1 provides an overview of thesystem. The first part of the solution is the collecting client;it interfaces with the spectrum analyser and transmits datato the webservice. No limit exists on how many collectingclients can be present, however, more collecting clients willachieve a higher accuracy when discovering the location of2.4 GHz devices. The webservice receives the data from thecollecting client and stores it in a local lightweight database.The second part, the compiling client, sends queries to thewebservice for data which responds if it has data to match thespecific query. The compiling client compiles and sorts the datachronologically to graphically display the surrounding 2.4 GHzsignals. Each individual part is discussed in further detail inthe subsequent sections. For a more in depth discussion thanthe one presented here on the WiSpy SSM Tool and how eachcomponent works see [15].

A. WiSpy SSM Collector

This application, in essence, interfaces with the WiSpyspectrum analyser, displaying a line graph of the current signalamplitude VS frequency and transmits this data to the webser-vice to be stored. In addition to the signal data, the relatedtime, location and node information are also transmitted to thewebservice. The data is collected in real time and not modifiedin any way and temporarily stored in batches to be sent to thewebservice. The location is handled as GPS coordinates and theapplication provides additional functionality to interface witha GPS device to automatically update this field. By combiningautomatic GPS location updates with the application, roamingcollecting nodes are possible. Also, if no Internet or networkconnectivity is present, data can be directly serialised to afile to be transmitted at a later time. All data is stored andtransmitted as XML. This application is not resource intensiveand can therefore run minimalistically and unobtrusively onany machine, at any point on the network.

B. ASP.NET WebService

The webservice provides the interface to a database fromwhich the two applications send and request signal data.The webservice receives requests and responds to them; thewebservice is stateless. SQLite was the database chosen as itis a light weight solution, perfectly suited for a service whereminimal amounts of space are available; it has a small codefootprint and provides the necessary data types and operationsfor this project [16]. Data types of type TEXT and REALwhere used, and the tables and data are manipulated usingstandard SQL statements. The database is stored in a singledisk file, it has a simple and easy to use API, is self containedand the source code is available in the public domain.

C. WiSpy SSM Compiler

Once the signal data has been collected by numerous WiSpySSM Collectors and stored in the database via the webservice,it needs to be processed and meaningfully displayed in orderto discover the location of 2.4 GHz devices. The WiSpy SSMCompiler interfaces with the webservice to provide a list of allthe nodes present in the database, and the user has the optionof selecting all the nodes or a subset of the nodes to queryfor data. The user selects a time range from which they wouldlike to view data, and the query is sent to the webservice. Oncedata is returned it is sorted by time and ready to be viewed byeither replaying it in real time or quickly skipping through itusing the slider. The display can be rotated and scaled to theusers preferences to aid in locating devices. A screenshot ofthe compiler can be seen in Figure 2.

The data is displayed graphically on a scale grid, the scalecan be modified to the users preference by setting latitude,longitude and the width of the display. The signal data isdrawn to screen using circles for each Wi-Fi channel (1-13)that originates from the node location. The user has the optionof selecting which channels they would like to view, perhapsonly showing the most popular channels (1, 6 and 11) or aspecific channel. The larger the circle the further the signalis transmitted from its source to the collecting node, and the

Figure 2. Screenshot of WiSpy SSM Compiler in use

smaller the circle the closer the transmitted signal is to thecollecting node.

Prx

Ptx=

Gtx ×Grx × c2

(4×Π× d× f)2(1)

The equation used to calculate the distance is shown inequation (1) [17]. The symbols used in the signal equationare as follows: Prx is the received power (in watts). Ptx is thetransmitted power (in watts). Gtx is the gain of the transmittingantenna. Grx is the gain of the receiving antenna. c is the speedof light (3× 108). pi (Π) is approximated to 3.14159. d is thedistance between the receiving and transmitting antennas. f isthe frequency (in Hz).

The equation used to calculate the distance is for the idealline-of-sight scenario, which almost never holds in a real-life environment. In reality, the antenna gains and transmit-ting power will be hard to quantify (for different APs) andmultipath propagation of the signal and obstructions will haveunpredictable effects [10]. Any other 2.4 GHz signal sourcesin the area will also have unpredictable effects, for example, atransmitting Bluetooth device in the area could skew the resultsshowing a device to be slightly off course to where it is reallylocated.

Once the data has been drawn to the screen it needs tobe analysed and understood. With multiple collecting nodespresent and displaying their signal data, simultaneous andsynchronised, 2.4 GHz signal sources can be visualised andlocated. Firstly, the user needs to choose which channel(s)they wish to view, with all channels selected the view canbe cluttered. The channels to view can be decided by quicklyrunning through all the data and seeing which channels are

mostly used, and then by deselecting the undesired channels.The user can then begin to locate Wi-Fi devices, by usingthe method of trilateration, as discussed in section II. Themethod of trilateration requires a minimum of three collectingnodes, however accuracy can be incrementally increased by theintroduction of additional collecting nodes. The WiSpy SSMTool has no upper limit on how many collecting nodes can bepresent.

In the next section, results from numerous test cases areanalysed and evaluated. In addition to results, typical outputfrom both the WiSpy SSM Collector and WiSpy SSM Compilerare shown and discussed.

IV. TESTING AND RESULTS

This section evaluates the toolset developed in order todetermine its effectiveness and the results of both componentapplications (the Collector and Compiler) are discussed.

The experiments were conducted by utilising multiple APsfrom different vendors, and were configured in such a way thatthe APs were transmitting the majority of the time. The testsetup had an AP connected directly to a personal computer(PC) with an additional PC four meters away, the second PCwas installed with a Wi-Fi PCI card and a network was createdwith the two PCs. Tests were conducted by uploading filesfrom the PC at the AP to the second PC with the Wi-Fi card.The environment was evaluated beforehand to remove as manyas possible interference sources which could skew the results.All results discussed here were from collecting nodes at fixedlocations, although an evaluation with GPS dynamic locationupdates was also successfully conducted.

A. WiSpy SSM Collector Results

Figure 3. WiSpy SSM Collector - Channel 1 Download

Figure 4. WiSpy SSM Collector - Channel 6 Download

Initially the WiSpy SSM Collector was tested to ascertainwhether the data passed onto the webservice was accurateand meaningful. Three test cases are discussed, each with aconstant file download taking place at a set distance of fivemeters but on different Wi-Fi channels. These parameters wereset to test whether similar signal strength was received from

Figure 5. WiSpy SSM Collector - Channel 11 Download

different frequencies but over the same distance. The figures(Figures 3-5) show the output from the collector application.These have been cropped from the actual application displayfor the sake of clarity. The frequency (in MHz) runs along thex-axis and received power is shown along the y-axis (in dBm).Figure 3 shows high activity centred around 2412 MHz, whichdemonstrates a Wi-Fi channel 1 download, which was the testcase. Each Wi-Fi channel is 22 MHz wide and this is capturedcorrectly. Figure 4 shows a Wi-Fi channel 6 download andFigure 5 shows a Wi-Fi channel 11 download.

Another experiment using a laptop running the collectorapplication was conducted by initially standing near the trans-mitting AP and then moving further away from it. As expected,the signal strength reduced as the distance between the AP andthe spectrum analyser increased – the signal would have totravel further and would therefore incur free space loss. Usingequation (1) we confirmed that for a particular signal strengthreceived the distance at which the signal was transmitted canbe calculated.

Once the data from the WiSpy SSM Collector was confirmedto be accurate, evaluation of the WiSpy SSM Compiler wasinitiated. In these test cases, intermittent and irregular small filetransfers were chosen over large file downloads as we wantedto mimic real world Wi-Fi usage in an office or productionenvironment. The scale in all the following results is in meters(Figures 6-11).

B. WiSpy SSM Compiler Result Set 1

Figure 6. WiSpy SSM Compiler - Result 1 - Channel 1, 6 and 11

Figure 7. WiSpy SSM Compiler - Result 1 - Channel 6

Figure 6 displays a typical WiSpy SSM Compiler outputwhich is showing the most commonly used Wi-Fi channels;1, 6 and 11. The display is cluttered with overlapping coloursand circles. By quickly running through the data and analysingit, the user can decide which channel(s) they wish to viewmore closely. Figure 7 displays the same point of time asFigure 6, but only Wi-Fi channel 6 is shown. The brightest andthickest circles show the last signal data to be displayed. Themost current circles intersect (highlighted in yellow) withinapproximately two meters of the AP. This result is veryaccurate, as the AP was two meters away from the WiSpySSM Collector at the ’AP’ node.

Looking closely at Figure 7 we see smaller red circlesoriginating from the ’SNRGMobile’ and ’Hons41’ nodes,suggesting the signal is originating closer to them than wherethe AP is actually located. As both these circles are of a similarbrush width and brightness, they were collected around thesame time, it is possible that interference could have occurredwithin this area to skew the result.

C. WiSpy SSM Compiler Result Set 2

Figures 8 and 9 show a different physical layout of WiSpySSM Collectors. This result set is also based on a Wi-Fichannel 6 network. The area of intersection in Figure 8(highlighted in yellow) is larger than the previous test case(Result Set 1) but shows a fairly accurate display of where theAP may be. Figure 8 provides an area where the AP is actuallylocated and a person physically walking around the area couldpotentially see the AP.

Figure 9 was run under the same conditions as the previousresult, except that it is displaying a different point in time.Although Figure 9 shows a smaller intersection area thanFigure 8, the AP is not located within this area. It is possiblethat a potential interference source not present before, couldaccount for the mildly inaccurate result. Again, a personwalking around this area could potentially see the AP. For theduration of this test, similar results to the above were obtained.

Figure 8. WiSpy SSM Compiler - Result 2A - Channel 6

Figure 9. WiSpy SSM Compiler - Result 2B - Channel 6

D. WiSpy SSM Compiler Result Set 3

Two results were obtained under a new physical layout asseen in Figures 10 and 11. Wi-Fi channel 11 was used in thisresult set and a WiSpy SSM Collector was not placed nearthe AP for these results. Instead the three collecting nodeswhere situated around the AP and all at approximately equaldistances from it. In Figure 10, the highlighted area in yellowdisplays the area where the AP is most likely situated. Figure10 and Figure 11 provide very similar areas of intersection andfor the duration of this experiment the majority of the resultssuggested this highlighted area to be the location of the AP.The suggested area by the WiSpy SSM Compiler was a fairlyaccurate representation of where the AP was in fact located.

Figures 7-11 provide a possible location for a device, high-lighted in yellow. Using this highlighted area and an accurateknowledge of the location being surveyed, a physical inspectionof the area should allow the user to locate the 2.4 GHz device.By obtaining this information, a Wi-Fi signal map can be

Figure 10. WiSpy SSM Compiler - Result 3A - Channel 11

Figure 11. WiSpy SSM Compiler - Result 3B - Channel 11

created to aid the administrator in successfully implementinga Wi-Fi network.

V. CONCLUSIONS

Due to the ubiquitous nature of Wi-Fi networks, networkadministrators need to be able to perform site surveys in orderto properly design and implement their Wi-Fi networks. TheWiSpy SSM Tool locates surrounding networks as well asidentifies interference sources which allow the network admin-istrator to plan a network that uses the least cluttered channeland either avoid, compensate or eliminate known interferencesources within the geographical area of the proposed Wi-Finetwork. By creating a detailed map of the Wi-Fi network, anadministrator can ensure sufficient signal overlap between APsand prevent coverage holes.

Future work for this project include developing the ap-plication in Open Source Software to be ported onto theLinux and FreeBSD operating systems. Templates for typesof interferences could be implemented into the WiSpy SSM

Collector to automate detection of specific interference sourcessuch as Bluetooth devices, microwaves, cordless phones andadjacent Wi-Fi networks. The WiSpy SSM Compiler couldbe further developed to display the full spectrum of signaldata from each node on demand (similar to the line graphproduced in the Collector). This additional functionality wouldprovide the administrator with all the information they needat a central point. The WiSpy SSM Compiler could alsointegrate an option for under laying an image of the area underinvestigation, for example an image with the layout of an office,or perhaps a town map, or even potentially be extended toproduce ’KML’ outputs for integration with the popular GoogleEarth application, for mapping on a much wider scale.

REFERENCES

[1] Editors of IEEE 802.11, “Wireless LAN Medium Access Control (MAC)and Physical Layer (PHY) Specifications, Higher Speed Physical LayerExtension in the 2.4 GHz Band,” tech. rep., Institute of Electrical andElectronics Engineers, Inc., New York, IEEE 802.11b-1999 edition, 1999.

[2] Editors of IEEE 802.11, “Part II: Wireless LAN Medium Access Control(MAC) and Physical Layer (PHY) specifications, Further Higher DataRate Extension in the 2.4 GHz Band,” tech. rep., Institute of Electricaland Electronics Engineers, Inc., New York, IEEE 802.11g-2003 edition,2003.

[3] MetaGeek, “WiSpy V1 Spectrum Analyser.” Online; http://www.metageek.net/products/wi-spy, Accessed: 04/03/2007, 2006.

[4] Tropos Networks, “802.11 Technologies: Past, Present and Future.”Online: http://www.tropos.com/pdf/technology_briefs/tropos_techbrief_wi-fi_technologies.pdf, Accessed 22/10/2007, 2007.

[5] Editors of IEEE 802.11, “Part II: Wireless LAN Medium Access Control(MAC) and Physical Layer (PHY) Specifications, High Speed PhysicalLayer in the 5 GHz Band,” tech. rep., Institute of Electrical andElectronics Engineers, Inc., New York, IEEE 802.11a-1999 edition, 1999.

[6] Rose, C., Ulukus, S. and Yates, R, “Wireless systems and interferenceavoidance,” WINLAB, Department of Electrical and Computer Engineer-ing, Rutgers University, 2000.

[7] Farpoint Group, “Evaluating interference in wireless LANs: Recom-mended practice,” Fairpoint Group Technical Note, 2006.

[8] J. Geier, “Performing radio frequency site surveys to effectively supportVoWLAN solutions,” Helium Networks, 2006.

[9] X. Yang and A. P. Petropulu, “Joint statistics of interference in awireless communications link resulted from a poisson field of interferers,”Electrical and Computer Engineering Department, Drexel UniversityPhiladelphia, 2001.

[10] Button, D, “Tech articles: Effect of obstructions on RF signal propaga-tion.” Online: http://www.emswireless.com/english/Tech_Articles/tech_art03.asp, Accessed: 19/03/2007, 1999.

[11] MetaGeek, “MetaGeek Store.” Online: https://www.metageekstore.com/,Accessed: 04/03/2007, 2007.

[12] MetaGeek, “Wi-Spy Hardware Interface Specification.” Online: http://www.metageek.net/products-wi-spy-24x/development-specifications,Accessed: 05/06/2007, 2006.

[13] Bardwell, J, I’m Going To Let My Chauffeur Answer That: Math andPhysics for the 802.11 Wireless LAN Engineer. 2003.

[14] Murphy, W. S. and Hereman, W, “Determination of a position in threedimensions using trilateration and approximate distances.” Departmentof Mathematical and Computer Sciences, Colorado School of Mines,Golden, Colorado, MCS-95-07, 19 pages, 1999.

[15] Wells, D., “IEEE 802.11 Signal Source Mapping using Low Cost Spec-trum Analysers.” Department of Computer Science, Rhodes University,2007.

[16] SQLite, “SQLite Home Page.” Online: http://www.sqlite.org/, Accessed01/09/2007, 2007.

[17] Prof. J. L. Jonas. Department of Physics & Electronics, Rhodes Univer-sity, 2007.

Mr Daniel Wells has recently completed his BSc (Hons) in Computer Scienceand Information Systems under the guidance of Ingrid Siebörger and BarryIrwin from the Department of Computer Science. Daniel is now reading forhis MSc in Computer Science and working for the Centre of Excellence (CoE)at Rhodes University as a system administrator.